Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have setup a Windows Server 2008 Active Directory Controller. As part of the installation, I've also added the role of Certificate Authority to my Windows Server 2008 Domain Controller. (This box also provides DNS lookups & DHCP support)

Anyway, I've created my domain ("TheSimpsons.local"), and the Domain Controller is (obviously) part of the domain ("Homer.TheSimpsons.local")

However, when I attempt to use SSL certificates on the server, they only "work" when I use the fqdn of the server. (Where "work" means the web-browser does not show a security warning when the user accesses the server)

So https://homer/ -> Shows a "Security Warning" page where the certificates don't match But https://homer.thesimpsons.local/ -> No security warning

Is it possible to generate a certificate such that both the fqdn & short name of the computer can be successfully authenticated with the cert?

(I've looked into Wildcard certificates a bit, but it seems to me that they many variations of a fdqn (such as www.server.local, server.local, test.server.local, etc), but doesn't support both a short name & a fqdn, but I could be wrong!)

share|improve this question
up vote 3 down vote accepted

The SSL Certificate option which your looking for is called SAN (Subject Alternative Names) It will allow you to add the local hostname alongside the external url.
You can pick them up from Globalsign and is asked as part of the certificate request. I hope this helps you.

share|improve this answer
Thanks for the helpful response. I'm now looking into generating SAN certificates. Since everything I'm doing is only internal, I don't need to go to Globalsign or any third party...I just need to figure out how to make Windows Server 2008 CA generate one for me :-P – Dan Dec 17 '10 at 4:51
Hi No problem, just another through you could add a local CNAME to redirect to your internal FQDN? - I'm also not sure if the 2008 CA can create a SAN supported SSL Certificate. - On a side note if i have answered your question could you mark my answer as correct? – JamesK Dec 17 '10 at 9:28

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.